Run remote coding agents safely: keys, fingerprints, no open ports

A coding agent that runs on your own computer can read your code, run commands and push to your repositories. Reaching it from a phone is useful exactly because it is powerful, and for the same reason the connection deserves some care. The good news is that the safe setup is also the simple one: no open ports, keys instead of passwords, and one check you do with your own eyes the first time you connect.

This post walks through that setup piece by piece, then lists what Herdr Pocket keeps on the phone and what it never sees.

Start with the threat you actually have

For one person reaching their own Mac, the realistic risks are short:

• The internet finds your SSH port. An SSH port forwarded on a home router is found by automated scanners, which then try passwords on it.
• Someone sits in the middle. On a hotel or café network you cannot be sure the machine answering is your machine.
• A device goes missing. A lost phone should not mean a rebuilt Mac.
• The agent does something you did not intend. That one is about how you run the agent, not the network, and we come back to it at the end.

Each of the steps below answers one of these.

Keep SSH off the public internet

The first rule is not to forward port 22 on your router at all. A private overlay network such as Tailscale gives you the reach without the exposure. Each device signs in to your tailnet, connections between them are encrypted with WireGuard, and Tailscale finds a path through NAT on its own, falling back to its relay servers when a direct path does not work. Your Mac's SSH server is then reachable from devices in your tailnet, and nothing on the router needs to change.

Herdr Pocket runs Tailscale inside the app, so the phone does not need the Tailscale app or a VPN profile. While it is connected, Tailscale's coordination server registers the phone with its device name, keys and addresses, and a relay may carry encrypted packets until a direct path works. SSH runs inside that tunnel, so a relay only ever sees encrypted traffic, never terminal content or credentials. Herdr Pocket turns off Tailscale's log upload. ZeroTier, EasyTier and SSH jump hosts work too if you already use one of them.

Narrow the tailnet to what the phone needs

A new tailnet lets every device reach every other device. That is convenient and usually broader than you need. Tailscale's access control policy lets you say exactly who may reach what. A policy that only lets your own devices reach the Mac's SSH port could look like this:

{
  "tagOwners": { "tag:agent-host": ["autogroup:admin"] },
  "grants": [
    {
      "src": ["autogroup:member"],
      "dst": ["tag:agent-host"],
      "ip":  ["tcp:22"]
    }
  ]
}

Tag the Mac as tag:agent-host in the admin console, and keep your other rules for the devices that need them. Two related switches are worth knowing: device approval, which holds a new device until an admin approves it, and key expiry, which makes a device sign in again after a while. If you tighten the rules later, remember the phone still needs port 22 on the Mac, or the connection will time out.

One more Tailscale detail: Tailscale SSH is a separate feature that takes over port 22 for tailnet connections and authenticates with your Tailscale identity instead of SSH keys. Herdr Pocket uses the computer's own SSH server and its own key, so turn Tailscale SSH off on that computer with tailscale set --ssh=false and use macOS Remote Login instead.

Use a key, one per phone

Passwords can be guessed, phished and reused. An SSH key pair cannot be guessed, and the computer only ever stores the public half. Herdr Pocket makes its key on the phone the first time you need one. The private half stays in the iOS Keychain, available after the phone's first unlock and never synced to iCloud or copied to another device. Ed25519 is the default; an RSA key is there for servers that require one.

To install the key, Connect a Computer can use your computer password once, add the public key, check that the key works, and forget the password. If you prefer never to type that password on the phone, choose Run a Command Instead and paste a one-line command on the computer yourself.

Every phone gets its own key, and each line it adds to ~/.ssh/authorized_keys ends with that phone's name, such as herdrpocket-iphone-3fa91c. That is what makes the lost-phone case easy: delete that one line on each computer, remove the phone from the Tailscale admin console, and every other device keeps working.

Check the fingerprint once, then let the app remember it

The first time you connect, Herdr Pocket shows the computer's host key fingerprint. Compare it with what the computer itself reports. On a Mac, open Terminal and run:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

If the two match, tap Trust. If you tap Don't Trust, nothing is sent to the computer: no key and no password. From then on Herdr Pocket remembers the fingerprint, and if it ever changes it stops instead of connecting. A changed fingerprint can mean the computer was reinstalled, or that someone is intercepting the connection. Check it on the computer before you go on.

What Herdr Pocket stores, and where

• On the phone, in the Keychain: the device key's private half, a saved Host password if you chose to save one, and Tailscale auth keys or other network secrets.
• On the phone, in the app: your Host list, settings, the host fingerprints you trusted, and a Chat cache of conversations you opened. That cache uses iOS Complete file protection, is excluded from backups, holds at most 300 MB and drops conversations you have not opened for 30 days.
• On your computer: the public key line in ~/.ssh/authorized_keys. Your code, the agents and their transcripts stay where they already were.
• Nowhere else: there is no Herdr Pocket account, server, analytics or tracking. Terminal output, prompts and files travel only over SSH between your device and your computer.

The full detail is in the privacy policy.

The agent is the other half

A tight network does not limit what an agent does once it runs. Keep the agent's own approval settings on for anything that touches the outside world, such as pushing, deploying or deleting, and work in a git branch or worktree so a bad run is easy to throw away. The phone is a good place to say yes or no to a single permission prompt. It is not where you want to review a large change for the first time.

A short checklist

1. No port forwarding; reach the computer over a tailnet.
2. Tailscale SSH off on that computer, Remote Login on.
3. Access rules that let the phone reach port 22 on the computer, and little else.
4. A key per phone; the password used once, or not at all.
5. The fingerprint compared on the computer itself.
6. You know the two places to revoke access: authorized_keys and the Tailscale admin console.

If you want to try this setup, Herdr Pocket is in a free public beta: join it on TestFlight, connect your first computer, and compare the fingerprint before you tap Trust.